From f885b0a51964428da2dc48acb2ecbcee15567ff6 Mon Sep 17 00:00:00 2001 From: "Collin M. Barrett" Date: Sun, 24 Jan 2021 14:31:39 -0600 Subject: [PATCH] =?UTF-8?q?refactor(reverse-proxy):=20=E2=99=BB=20csp=20tw?= =?UTF-8?q?eaks?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- reverse-proxy/conf.d.dev/default.conf | 6 +++--- reverse-proxy/conf.d/default.conf | 12 ++++-------- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/reverse-proxy/conf.d.dev/default.conf b/reverse-proxy/conf.d.dev/default.conf index 235e3f97a..0f37b3cd2 100644 --- a/reverse-proxy/conf.d.dev/default.conf +++ b/reverse-proxy/conf.d.dev/default.conf @@ -6,20 +6,20 @@ server { rewrite ^/api/archival/(.*)$ /$1 break; proxy_pass http://archival-api:80; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self';" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';" always; } location ^~ /api/directory/ { rewrite ^/api/directory/(.*)$ /$1 break; proxy_pass http://directory-api:80; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self';" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';" always; } location ^~ /api/ { rewrite ^/api/(.*)$ /$1 break; proxy_pass http://api-docs:8080; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' validator.swagger.io data:;" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' validator.swagger.io data:;" always; } } \ No newline at end of file diff --git a/reverse-proxy/conf.d/default.conf b/reverse-proxy/conf.d/default.conf index b9fbc0682..1bbd504b6 100644 --- a/reverse-proxy/conf.d/default.conf +++ b/reverse-proxy/conf.d/default.conf @@ -9,27 +9,27 @@ server { rewrite ^/api/archival/(.*)$ /$1 break; proxy_pass http://archival-api:80; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self';" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';" always; } location ^~ /api/directory/ { rewrite ^/api/directory/(.*)$ /$1 break; proxy_pass http://directory-api:80; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self';" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';" always; } location ^~ /api/ { rewrite ^/api/(.*)$ /$1 break; proxy_pass http://api-docs:8080; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' validator.swagger.io data:;" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' validator.swagger.io data:;" always; } location / { proxy_pass http://web:80; include location-includes/*; - add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'none'; connect-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; manifest-src 'self';" always; + add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; manifest-src 'self';" always; } } @@ -37,7 +37,6 @@ server { server { listen 80 default_server; server_name filterlists.com; - include server-includes/*; return 301 https://filterlists.com$request_uri; } @@ -46,8 +45,5 @@ server { listen 80; listen 443 ssl http2; server_name www.filterlists.com; - include server-includes/*; - ssl_certificate /etc/nginx/cert/filterlists_cert.pem; - ssl_certificate_key /etc/nginx/cert/filterlists_key.pem; return 301 https://filterlists.com$request_uri; } \ No newline at end of file